Unfree package causes a rebuild for each new tree

[bd-bond]

I have an unfree package in a devshell defined in a project's flake.nix, and for each unique git tree (branch) that executes a pipeline that uses that devshell, the package is rebuilt from scratch. The package is uploaded to the cache successfully, but other trees will not ever benefit from this. Subsequent pipeline runs on the same tree seem to re-use the cached package as expected.

This causes a painfully slow pipeline for each new branch, and for merging if using a merge queue. I'm led to believe that the cache is indexed on the specific tree.

• Is this expected behavior?
• Is there a way to avoid this behavior, such as ensuring that cache is indexed by some other identifier than what is currently being used? For example, a common pattern when using the GHA cache is to set restore-keys to foo-bar-${{ hashFiles('flake.nix') }} AND foo-bar-. This lets the action/cache fall back. Can this kind of behavior be implicitly supported in this action?

For context, here's a snippet from my flake.nix showing the package and devshell:

config.allowUnfreePredicate = pkg: builtins.elem (nixpkgs.lib.getName pkg) [
  "terraform"
];

...

devShells = forAllSystems ({ pkgs }: {
  terraform-shell = with pkgs; mkShell {
    packages = [
      terraform
    ];
  };
};

And the pipeline configuration:

name: lint

on:
  workflow_call:

jobs:
  filter:
    name: filter
    runs-on: ubuntu-latest
    outputs:
      terraform: ${{ steps.filter.outputs.terraform }}
      terraform_files: ${{ steps.filter.outputs.terraform_files }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          list-files: shell
          filters: |
            terraform:
              - added|modified: '**/*.tf'

  terraform:
    name: terraform
    runs-on: ubuntu-latest
    needs:
      - filter
    if: needs.filter.outputs.terraform == 'true'
    steps:
      - uses: actions/checkout@v4
      - uses: determinatesystems/nix-installer-action@main
      - uses: determinatesystems/magic-nix-cache-action@main
        with:
          use-flakehub: false
      - run: |
          nix develop .#terraform-shell \
            --command terraform fmt -check -diff ${{ needs.filter.outputs.terraform_files }}